CVE-2026-6830

CVE-2026-6830 affects nesquena hermes-webui and involves an environment variable leakage vulnerability during profile switching. The application fails to clear environment variables from a previously active profile before loading a new profile, allowing attackers or users to access sensitive secrets such as provider API keys across different profile contexts. This breaks the intended security isolation mechanism between user profiles. The vulnerability has a CVSS score of 3.3 (LOW) with a local attack vector requiring low complexity and user privileges, resulting in limited confidentiality impact with no integrity or availability implications. The EPSS score of 0.000120 indicates extremely low prevalence among all known CVEs, suggesting this is a relatively uncommon threat in active exploitation landscapes. There is currently no evidence of active exploitation or public exploit code availability. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on vulnerability hotlists, indicating minimal community attention and low demonstrated real-world threat activity. Organizations using hermes-webui should prioritize patching based on their environment sensitivity rather than immediate threat urgency.